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Abstract 

Multiplicity codes are algebraic error-correcting codes generalizing classical polynomial evaluation 
codes, and are based on evaluating polynomials and their derivatives. This small augmentation confers 
upon them better local decoding, list-decoding and local list-decoding algorithms than their classical coun¬ 
terparts. We survey what is known about these codes, present some variations and improvements, and 
finally list some interesting open problems. 
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1 Introduction 


Reed-Solomon codes and Reed-Muller codes are classical families of error-correcting codes which have been 
widely influential in coding theory, combinatorics and theoretical computer science. These codes are based 
on evaluations of polynomials: a codeword of one of these codes is obtained by evaluating a polynomial over 
a finite field Fg of degree at most d at all points in F™. 

Multiplicity codes are a family of recently-introduced algebraic error-correcting codes based on evaluations 
of polynomials and their derivatives. Specifically, a codeword of a multiplicity code is obtained by evaluating 
a polynomial of degree at most d, along with all its derivatives of order < s, at all points in F™. 

The s = 1 versions of multiplicity codes are thus the classical Reed-Solomon (m = 1) and Reed-Muller 
(m > 1) codes. We will see that by allowing s to be larger than 1, in many senses general multiplicity codes 
go beyond their s = 1 counterparts. 

Multiplicity codes with m = 1 (i.e., based on univariate polynomials) were first considered by Rosenbloom 
and Tsfasman |RT97) . who studied them for the purposes of producing optimal codes for the “M metric” 
(now known as the Rosenbloom-Tsfasman metric). They were also studied by Nielsen [NieOlj . who showed 
that they admit list-decoding algorithms upto the Johnson bound, similar to the Reed-Solomon codes. 

Multiplicity codes with general m, s were defined by Kopparty, Saraf and Yekhanin |KSY11) . The main result 
of |KSY11) was that for every e, a > 0, for all k, there are multiplicity codes of dimension k, rate 1 — a, and 
which are locally decodable from a constant fraction of errors with in just Oe,a{k^) time. Prior to |KSY11) . 
codes with nontrivial local decoding algorithms were known only at rate R < 1/2, and achieving local 
decoding complexity O ik^) required the code to have rather small rate R = e'd-ff-) (the codes that were known 
to achieve these parameters were the Reed-Muller codes). It should be noted that more recent results have 
shown how to construct codes achieving parameters similar to those of multiplicity codes using significantly 
different ideas: Guo-Kopparty-Sudan [GKS13) . Guo [Guo 13] and Hemenway-Ostrovsky-Wooters |HOW13) . 

Subsequently, Guruswami-Wang |GWllj and Kopparty |Kopl2| studied the list-decoding of univariate mul¬ 
tiplicity codes, and showed that there are sequences of univariate multiplicity codes of rate R, list-decodable 
from 1 — R — € fraction errors in polynomial time (achieving the so-called list-decoding capacity, thus provid¬ 
ing another route to such codes after the breakthrough results of Parvaresh-Vardy |PV05j and Guruswami- 
Rudra |GR08p . 

Global decoding of multivariate multiplicity codes was also considered in |Kopl2| . There it was shown that 
multivariate multiplicity codes can be decoded upto half their minimum distance in polynomial time, and 
can be list-decoded from the Johnson bound in polynomial time. 

The primary purpose of this paper is to survey the state of the art algorithms for dealing with multiplicity 
codes. Along the way we note some variations and improvements. Specifically: 

1. We give an improved local decoding algorithm for multiplicity codes. The original local decoding 
algorithm of [KSYll] for multiplicity codes worked as follows: in order to recover the correct value 
of the multiplicity codeword at a point a S F™, one would take random lines in F^ passing 

through a, query the codeword on all those lines, and use the answer to decode the correct value at a. 
Our improved local decoding algorithm is based on queries only exp(TO) random lines through a. 

This new algorithm is based on two new ideas. First, we show that one can extract much more infor¬ 
mation from each line about the correct value at a than what the previous algorithm took advantage 
of. Second, we use a more sophisticated way of combining information from the different lines. For the 
previous algorithm, the problem of combining information from the various lines through a to recover 
the correct value of the codeword at a amounted to the problem of decoding a Reed-Muller code. In 
the new algorithm, this problem turns out to be a case of decoding a multiplicity code! 
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2. The above framework admits a number of variations that could potentially be interesting for their own 
sake. 

One variation leads to a “polynomial rate” constant-query error-correction scheme as follows: a message 
CT S Sq , where |So| = exp(n), gets encoded into a codeword c € S", where log |S| = n’^ ■ log jSolj such 
that even if a constant fraction of the coordinates of c are corrupted, for any giveifl i £ [n] one can 
recover ai with high probability using only 0(1) queries into c. Such large alphabet error-correction 
schemes were considered by Beimel and Ishai [BIOl] . 

Another variation allows local correction for some low rate multiplicity codes using only m lines, with 
a much simpler local correction algorithm. 

3. Using ideas from the above improvements, we give a new algorithm for (global) decoding of multivariate 

multiplicity codes. The original approach of |Kopl2| was based on a family of space filling 

curves that passed through all the points of F™. The new algorithm uses only exp(m) many curves. 
The property of the curves used in |Kopl2| was “algebraic repulsion”: no nonzero polynomial 

P{Xi ,..., Xm) of moderate degree can vanish on all these curves. The family of curves that we use in 
this paper can be smaller because we require a weaker property: no nonzero polynomial P{Xi ,..., Xm) 
of moderate degree can vanish on all these curves with high multiplicity. 

4. We observe that encoding and unique decoding algorithms for multiplicity codes can be implemented 
in near-linear time (i.e., they run in time 0{n ■ (logn)^^^^)) . For m = 1, this follows from algorithms 
nearly identical to the ones from the classical univariate (s = m = 1) case, and for general m it follows 
by refining a reduction to the m = 1 case given in |Kopl2| . 

5. We gather a number of open questions and possible future research directions for the study of multi¬ 
plicity codes. 


Organization of this paper: In the next section we formally define multiplicity codes and state their basic 
properties. In Section |3] we discuss decoding algorithms for univariate multiplicity codes. In Section |4] we 
discuss decoding algorithms for multivariate multiplicity codes. In Section[S]we discuss encoding algorithms. 
We conclude with some discussion and open questions. 


2 Multiplicity Codes 

We begin with some general preliminaries on codes, polynomials and derivatives, and then move on to state 
the basic definitions and results about multiplicity codes. 

2.1 Codes 

Let E be a finite set and let n be an integer. We will work with E" equipped with the (normalized) Hamming 
metric A, defined by: 

A{x,y)= 

ie[n] 

A code of length n over the alphabet E is a subset C of E”. The rate of the code is defined to be: 

n 

The minimum distance of the code C is defined to be the smallest value S of A(c, c') for distinct elements 
c, c' of C. 

^We use [n] to denote the set {1,2,..., n}. 
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Encoding If C C E" is a code, an encoding map for C is a bijection if : E§ —>■ C for some integer k. Often 
Eg = E, but it need not be. It will be important that this map E is efficiently computable and efficiently 
invertible. 


Unique Decoding In the problem of unique decoding the code C from ry-fraction errors, where rj < 6/2, 
we are given as input r € E", and we wish to compute the unique c € C (if any) such that A(r, c) < ij. The 
uniqueness follows from our condition relating t] and 6. 


List-Decoding In the problem of list-decoding the code C from ry-fraction errors, we are given as input 
r G E", and we wish to compute the set 


£ = {c G C I A(r, c) < f]}. 

The maximum possible value of |£| as r varies over all elements of E" is called the list-size for list-decoding 
C from r] fraction errors. 


Local Correction and Local Decoding In the problem of locally correcting the code C from ? 7 -fraction 
errors, where rj < 5/2, we are given oracle access to a string r G E”, and given as input i G [n], and we 
wish to compute Ci for the unique c G C (if any) such that A(r, c) < rj. The query complexity of such a local 
correction algorithm is the number of queries made to r; both the query complexity and time complexity 
could potentially be sublinear in n (and indeed this is the interesting case). 

For local decoding, we deal with a code C along with an encoding map if : E§ — )> C. In the problem of 
local decoding (C, E) from ry-fraction errors, where rj < 5/2, we are given oracle access to r G E”, and input 
i G [fc], and we wish to compute Xi for the unique a: G Eq (if any) such that A{r,E{x)) < rj. The query 
complexity of such a local decoding algorithm is the number of queries made to r; again, both the query 
complexity and time complexity could potentially be sublinear in n (and indeed this is the interesting case). 

The difference between local decoding and local correction is that in local decoding, we are trying to recover 
symbols of the original message, while in local correction, we are trying to recover symbols of the codeword. 


2.2 Polynomials and Derivatives 

For a vector i = (*i,..., im) of non-negative integers, its weight, denoted wt(i), equals 

For a field F, let F[Xi,..., Xm] = F[X] be the ring of polynomials in the variables Xi,..., Xm with coefficients 
in F. For a vector of non-negative integers i = (ii,..., im), let X‘ denote the monomial O^i ^ F[X]. 

We now define derivatives and the multiplicity of vanishing at a point. 

Definition 1 ((Hasse) Derivative) For P{'K) G F[X] and non-negative veetori, the ith (Hasse) derivative 
of P, denoted P^'\'X.), is the coefficient of Z* in the polynomial P(X, Z)'^^P(X -1- Z) G F[X, Z]. 

Thus, 

P(X-f Z) =^pW(X)Zh (I) 

i 

We will need some basic properties of the Hasse derivative (see |HKT08j l. 

Proposition 2 (Basic properties of Hasse derivatives) Let P(X),(3(X) G F[X]'" and let i, j be vec¬ 
tors of nonnegative integers. Then: 
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1. P«(X) + Q«(X) = (P + Q)«(X). 

(P • g)«(x) = Eo<e<i 
3. (p(*))^''^ (X) = ('+j)p('+j)(X). 

Definition 3 (Multiplicity) For P(X) S F[X] a77.c? a G F™, t/ie multiplicity of P at a G F"*, denoted 

mult(P, a), 15 the largest integer M such that for every non-negative vector i with wt(i) < M, we have 
p(i) 

(a) =0 (if M may be taken arbitrarily large, we set mult(P, a) = oo). 

Next, we state a basic bound on the total number of zeroes (counting multiplicity) that a polynomial can 
have on a product set S’"* . An elementary proof of this lemma can be found in [DKSS09] . 

Lemma 4 Let P G F[X] be a nonzero polynomial of total degree at most d. Then for any finite S' C F, 

mult(P,a) < d - |Sr-^ 

slGS^ 

In particular, for any integer s > 0, 

> »1 < ^- 


2.3 Multiplicity Codes 


Finally, we come to the definition of multiplicity codes. 

Definition 5 (Multiplicity code |KSYll| i Let s, d, m be nonnegative integers and let q be a prime power. 

Let E = Fq P(Xi,... , X^) G ¥q[Xi, ..., Xm], we define the order s evaluation of 

P at a, denoted p(<®)(a), to be the vector (P^*n^))wt(i)<s G 5]. 

The multiplicity code of orders evaluations of degree-d polynomials in m variables over Fg is defined as fol¬ 
lows. The code is over the alphabet E, and has length (where the coordinates are indexed by elements of 
F™). For each polynomial P(X) G Fg[Xi,... ,Xm] with deg(P) < d, there is a codeword in C given by: 

EnCs,d,m,g{P) = (P«*)(a))a6Fj. G (E)«'” . 

Technically speaking, we have only defined the multiplicity code as a subset of E®'« , without specifying an 
encoding map. We postpone the choice of a good encoding map to a later section. 


Lemma 6 (Rate and distance of multiplicity codes [KSY11| 1 Let C be the multiplicity code of order 
s evaluations of degree d polynomials in m variables over F^. ThenC has minimum distance at least 6 = 1--^ 


and rate 




which is at least 


TO + 5 


sq 




We usually think of to and s as large constants (significantly smaller than q), and in light of the above 
parameters, having s ^ to^ is particularly interesting. For the rest of this paper, when we speak of near- 
linear time algorithms, this assumes that to and s are constants, and that q and the blocklength q"* tend to 
oo. 

One can easily convert such codes into codes over a constant sized (and even binary) alphabet via concate¬ 
nation, while preserving the local decoding/correction properties. For details, see [KSYllj . 
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3 Decoding Univariate Multiplicity Codes 

We begin by discussing decoding of univariate multiplicity codes. 


3.1 Unique Decoding 

The classic Berlekamp-Welch algorithm for decoding Reed-Solomon codes up to half the minimum distance 
has a simple generalization to the case of univariate multiplicity codes. This generalization was first discov¬ 
ered by Nielsen [NieOlpl . In fact, Nielsen showed how to do list-decoding of univariate multiplicity codes, 
discussed next. 

Let us set the problem up. Recall that the alphabet for this code is F*. Thus the received word is a function 
r ; Fq —7> F®. Abusing notation, we view this as a tuple of s functions : F^ —^ F^ for 0 < i < s. We wish 
to find the unique P{X) such that A(EnCs,d,i,q(P), r) < 5/2. 

The algorithm tries to find an error-locator polynomial E{X) and another polynomial N{X), such that 
N{X) =E{X)-P{X). 

• Search for nonzero polynomials E{X), N{X) of degrees at most {sq — d)/2, {sq -I- d)/2 respectively 
such that for each x G Fg, we have the following equations: 

N{x) = E{x)r^^'^ (x) 

(x) = E{x)r^^'^ (x) -I- E^^'^ (x)r^°^ (x) 

(2) 

S —1 

iV('*-i)(x) = ^£;«(x)r('*-i-*)(x) 

i=0 

This is a collection of sq homogeneous linear equations in {sq — d)/2 -|-1 -|- {sq + d)/2 + l> sq unknowns 
(the coefficients of E and N). Thus a nonzero solution E{X), N{X) exists. Take any such nonzero 
solution. 

• Given E{X), N{X) as above, output ■ 

The analysis proceeds by showing that N{X) — P{X)E{X), which is a degree {sq + d)/2 polynomial, has 
> {sq + d)/2s zeroes of multiplicity > s, and is thus the zero polynomial. This implies that P{X) = 
N{X)/E{X), and so P{X) is the output of the algorithm, as desired. 


3.1.1 Unique decoding in near-linear time 

In this subsection we describe how to implement the above algorithm in near-linear time. The presentation 
follows the description of a near-linear time implementation of the Berlekamp-Welch algorithm in Sudan’s 
lecture notes ISiidnij . 

Let R{X) be the unique polynomial of degree at most sq — 1 such that for each a G F, and i < s, 

R«^)(a) =r«")(a). 

^Nielsen’s theorem analyzes the decoding radius in terms of the m-metric, and implies the decoding algorithms for the 
Hamming metric considered here. 


6 








Such an R{X) can be found in near-linear time by the classical Hermite interpolation algorithm of Chin |Chi76] . 
If E{X) and N{X) satisfy the equations ([2]), then we have that N{X) — E{X)R{X) vanishes at each x S Fg 
with multiplicity at least s. Thus: 

N{X) = E{X)R{X) - C{X) ■ (X« - xy, 

for some C{X) G Fq[X]. Equivalently, 


N{X) R{X) C(X) 

E(x)(x<i - xy ~ (XI-xy ~ E(xy 

Thus we are looking for C'(X), E(X) such that: 

1. deg(E(X)) < (sq-d)/2, 

2. the rational function approximates the rational function in the sense that the numerator 

of their difference N(X) = R(X)E(X) — C{X){X‘> — X)® has degree at most (sq + d)/2. 

This problem can be solved in near-linear time via Strassen’s continued fraction algorithm |Str81) . In fact, 
one can minimize the degree of N{X) subject to the constraint that deg(E(X)) < (sq — d)/2. 

Finally, the division step can also be performed in near-linear time. This completes the description of the 
near-linear time implementation of the unique decoder for univariate multiplicity codes. 


3.2 List-Decoding 


We now discuss the list-decoding of univariate multiplicity codes. Here we consider the problem of decoding 
from a fraction of errors which may be larger than half the minimum distance 6. 

By the Johnson bound, we know that for list-decoding univariate multiplicity codes from (I — \/I — J)- 
fraction errors, the list-size is at most poly(< 7 ) (this only uses the fact that the distance of the code is > J). It 
is thus reasonable to ask whether there is a polynomial time algorithm to list-decode univariate multiplicity 
codes from (1 — s/l — (5)-fraction error. 

In [NieOlj . Nielsen gave such an algorithm. His algorithm generalizes the Guruswami-Sudan algorithm for 
list-decoding Reed-Solomon codes, and is also based on interpolation and root-finding. 

Given a received word r : Fg —>• F®, one first interpolates a low-degree bivariate polynomial Q(X,Y) G 
Fq[Jf, y] such that for each a G¥q, the polynomial Q(X,J2jZo r^^\a)(X — aY) vanishes with high multi¬ 
plicity at X = a. One then shows that every P{X) G Fg[Jf] of degree at most d with A(EnCs_d,i, 5 (^’),"c) — 
1 - VTEs, we have Q{X,P(X)) = 0. Finally, one can find all polynomials P(X) satisfying this latter 
equation. 

Recently Guruswami-Wang [GWIIj and Kopparty |Kopl2| independently found improved results for list¬ 
decoding univariate multiplicity codes over prime fields. 

The main result of [GWll] is that order s univariate multiplicity codes of distance S over prime fields can, 
for every integer 0 < f < s, be list-decoded from rjt fraction errors with list-size at most q^^^\ where: 


Vt 


t-t-2y S — t J 


For t = 0, the algorithm boils down to Nielsen’s version of the Berlekamp-Welch algorithm for unique¬ 
decoding multiplicity codes. 
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The main result of |Kopl2| is that order s univariate multiplicity codes of distance S over prime fields can, 
for every integer 0 < t < s be list-decoded from 77 ^ fraction errors with list-size at most where: 

For t = 0, the algorithm boils down to Nielsen’s version of the Guruswami-Sudan algorithm for list-decoding 
univariate multiplicity codes. 

Both these algorithms are based on deriving an order t differential equation of the form: 

Q{X, P(X), ..., = 0 


from the received word r, such that every P whose encoding is close to r must satisfy this differential 
equation. In the algorithm of |GW11] this differential equation is a linear differential equation, and in the 
algorithm of |Kopl2| this equation is a polynomial differential equation. These differential equations are 
then solved using Hensel-lifting / power series. See |GW11] and |Kopl2| for the details. The decoding radius 
77 ' is always greater than rjr, but the algorithm and analysis of |Kopl2| are also more involved than that 
of |GW11] . 


It is well known that the maximimum fraction of errors rj from which a code of rate R and block-length n 
can be list-decoded from while still having poly(7T,) list-size is 1 — i? — e (for arbitrarily small e > 0). A code 
which achieves this is said to achieve list-decoding capacity. The first constructions of codes which achieved 
list-decoding capacity came from the breakthrough results of Parvaresh-Vardy [PV05] and Guruswami- 
Rudra |GR08] . The above-mentioned results of [GWll] and |Kopl2| show that univariate multiplicity codes 
over prime fields achieve list-decoding capacity for every R G (0,1). This follows by noting that for univariate 
multiplicity codes, R — 1 — S, and that for every <5, if we take r to be a very large constant, and s to be a 
much larger constant, then the above decoding radii rjr and 77 ^' approach S = 1 — R. 


4 Decoding Multivariate Multiplicity Codes 

4.1 Local Correction 

We begin by discussing local correction algorithms for multiplicity codes. When coupled with a systematic 
encoding map (which we discuss in the next section), this also gives local decoding algorithms for multiplicity 
codes. 

4.1.1 Preliminaries on Restrictions and derivatives 

We first consider the relationship between the derivatives of a multivariate polynomial P and its restrictions 
to a line. Fix a, b S F™, and consider the polynomial Q{T) = P{a + hT). 

• The relationship of Q{T) with the derivatives of P at a: By the definition of Basse derivatives, 

Q{T) = 


Grouping terms, we see that: 


P*'‘^(a)b' = coefficient of in Q{T). 

i|wt(i)=j 


(3) 


























• The relationship of the derivatives of Q at t with the derivatives of P at a + th: Let t G F,. 

By the definition of Basse derivatives, we get the following two identities: 


P{a + h{t + R)) = Qit + R) =Y,Q^^Ht)R^ ■ 

j 

P{a + h{t + R)) = ^P(‘)(a + bt)(bi?)h 

i 

Thus, 


Q«(t) = E p(‘)(a + bt)bL 

i|wt(i)=i 


(4) 


In particular, is simply a linear combination of the various P^^^{a + ht) (over different i). 

We now apply these observations to the derivatives of P. For each nonnegative tuple e G Z™, consider the 
polynomial Qe{T) = p(®)(a + bT). 

• The relationship of Qe{T) with the derivatives of P at a: 

(p(e))(i)(a)b* = = coefficient of T-^ in (5e(F). (5) 


In particular, knowing Qe{T) gives us several linear relations between the evaluations of the derivatives 
of P at a. 

• The relationship of the derivatives of Qe at t with the derivatives of P at a + tb: Let t G F^. 

We get 

QW(t)= (P('=))«(a + bt)b‘= Y + (6) 

i|wt(i)=j i|wt(i)=i ^ 


In particular, Qe \t) is simply a linear combination of evaluations, at a + bt, of the various derivatives 
of P. 


4.1.2 The Local Correction Algorithm 

We now give our local correction algorithm which corrects (5o < | fraction errors. The 7 = 0, c = 1 case of 
this algorithm is the orignal local correction algorithm of [KSYll] . Increasing 7 reduces the query complexity 
from to exp(m), while reducing the fraction of correctable errors by a negligible amount. 

Main Local Correction Algorithm: 

Input: received word r : F™ —>■ S, point a G F™. Abusing notation again, we will write r*^*^(a) when we 
mean the i coordinate of r(a). 

1 . Set 7 = 1 - Set c = 7 • s + 1. 

2. Pick a set B of directions: Pick z, yi, y 2 ,... ym G F™ independently and uniformly at random. Let 
S' C Fq be any set of size |"^1. Define 

m 

^ = {z+E I ^ 

t=i 
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3. Recover + bT) for directions b G 5: For each e with wt(e) < c and each b G _B, consider 

the function £b,e : —>■ given by 

(4,eW),= E (''^‘)r-'‘=+')(a + bt)bS (7) 

for each 0 < j < s — wt(e). Via a univariate multiplicity code decoding algorithm, find the unique 
polynomial Qh,e{T) G F,[T] of degree at most d — wt(e) (if any), such that 

A(EnCg_^j,^e),(i—wt(e),l,g(Qb,e); ^b,e) ^ 

4. Decode a constant degree multiplicity code to recover Denote the coefficient of 

in (5b,e(r) by ?;yb,e G F,. If j < 0, we define Vj^b.e = 0. 

For each j' with 0 < j' < s, find the unique homogeneous degree f polynomial Rji{'K) G Fq[X] such 
that for at least 1/3 of the b G -B, for all e with wt(e) < c, we have: 

Bj/ (b) 'i^j' —wt{e).h.e- 

Note that this is a constant degree multiplicity code decoding problem. 

If such an Rji does not exist, or is not unique, the algorithm outputs FAIL. 

For each i with wt(i) < s, define Mi to equal the coefficient of X‘ in i?wt(i)(X). 

5. Output the vector (Mi)wt(i)<s- 

We quickly comment on the running time and query complexity. The running time consists of lAI™ instances 
of decoding univariate multiplicity codes over F^, as well as on instance of decoding a degree-s m-variate 
order-c multivariate multiplicity code with evaluation points being A™. Thus, if m,s are constant, the 
running time is near-linear in q, which is near-linear in where n is the block-length of the code. The 

query complexity is lAI™ • q, which equals For 6 = 0(1) and So < 6/lQ (say), the query 

complexity equals exp(m) • 


4.1.3 Analysis of the Local Correction Algorithm 

We now analyze the above local correction algorithm. 

Theorem 7 Let P(X) G Fq[X] he such that A(EnCs,d.m,g(B), r) < do- Let a G F™. 

With high probability, the local correction algorithm above outputs P*^^®^(a). 

Proof Let E = {x G F™ | ^ r(<'*^(x)} be the error set. We have \E\ < do ■ g™. 

Let Lb = {a + th \t £ F^} be the line through a in direction b. We call b bad if |Lb r\ E\ > 4 • do ■ g. 
Note that at most 1/4 of all the lines are bad. 

Claim 8 With high probability, we have: 

1. at most 1/3 of the h £ B are bad, 

2. \B\ = i^r, 
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These basic probability/linear-algebra facts are well known, and we omit the proofs. 
Henceforth we assume that both these events happen. 

Claim 9 Ifhis good, then for every e with wt(e) < c, we have: 

Qb.e(T) = p(")(a + br). 


Proof The univariate multiplicity code of order s — wt(e) evaluations of degree d — wt(e) polynomials has 
minimum distance at least 1 — = 1 — which, by choice of 7 , is > 8 • do. 

If b is good, then we know that {L^nEl <4-do’'Z- By Equations ([7]) and ([ 6 |) , we conclude that p(®)(a + br) 
(which has degree d — wt(e)) satisfies: 

A(EnCs_wt(e),d-wt(e),l,(j(-P*''^^ ( 3 . + bT)), .^b,e) < ^ < 4 • dg , 

which is less than half the minimum distance of the univariate multiplicity code of order s —wt(e) evaluations 
of degree d — wt(e) polynomials. 

Thus P^®)(a + br) is the unique such polynomial found in Step 3, and so Qb,e{T) = + bP). ■ 


For each integer 0 < < s, define the polynomial: 

RA^)= E 

Claim 10 Ifh is good, then for all e with wt(e) < c, we have: 

Rjf (b) —wt(e),b,e; 

Proof We have: 

Rfoq= E 

= E 

i|wt(i)=i ^ 

where j = f — wt(e). 

Thus, 

Rf{b)= •£ (‘’ + y'-+‘'(a)b‘ 

= coeff. of in Qb,e(T) (by Equation ([SJ and ClaimO since b is good) 

—wt(e) ,b,e • 
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Thus Ry (X) satisfies the conditions required of Step 4 of the algorithm. 

Let us now show that no other polynomial can satisfy these conditions. Suppose there was some other 
solution Rj/(X.). Then the difference {Rji — Rji){X.) would be a nonzero polynomial of degree < s, that 
vanishes with multiplicity at least c, at > ^ of the points of B. But this cannot be, since B is an affine 
one-to-one image of the set S'™, and the fraction of points of S™ on which a nonzero polynomial of degree 
< s can vanish with multiplicity > c is at most c|S| - ^ ^ 2 ■ 'Thus the uuic^uG solution found, in Step 

4. 

Finally, we notice that our definition of Rj' implies that for every i, we have Ui = as desired. ■ 


4.1.4 Variations 

The above algorithm allows a number of variations that may be useful in different contexts. 

Let a £ F™. Suppose r : F™ —>• S is a received word, and suppose L’(X) G Fq[X] is a polynomial of degree 

at most d such that A(EiiCsy^m,qiP),'f) < Let 7 = and let c = 7 s -f 1. 

Let a £ F™. For each integer 0 < j' < s, define the polynomial: 

Ry{X)= Y. 

Suppose b £ F™ is good (meaning that the line La,b has < A6oq errors on it). As we saw in the above 

analysis, by querying all the points of the line La,bj we can compute for every j' < s and every e 

such that wt(e) < c. 

1. Suppose we are only interested in recovering Then this can be recovered by querying the 

points of just one line! Indeed, if we pick b at random, then with high probability b is good, and then 
by querying La,b we can compute i?^f^(b) for every j' < s and every e such that wt(e) < c. Note that 
for every e with wt(e) < c, we have = p(®)(b). Thus we can compute P^^‘^\a) with high 

probability. 

We now describe a coding scheme taking advantage of this. Specializing parameters, if we take S = 1/2, 
(5o = 1/100, s = d = {I — 6) ■ s ■ q, n = g™, 7 = -g, and so c > |. Let Eq = and let 

our space of messages be the space of all functions / : F™ —>• Eg. 

Define the encoding of the message / as follows: find any polynomial P(X) £ Fq[X] of degree at most 
{c + m) ■ q such that for each a £ F™, we have P^^‘^\a) = /(a) (that such a polynomial P exists is 
an interpolatability statement; it follows from the arguments in Appendix A of |Kopl2| ). By choice of 
parameters, {c + m) ■ q < d. The encoding of / is then defined to be EnCs,d,m,g(T’) & E". Note that 
log |E| = • logg, and log |Eo| = • logg ~ 7 ™ • log |E|. Thus this encoding blows up the 

bit-length of an alphabet symbol by a factor of 5™, which is at most a sublinear polynomial in n for 
g > 5. 

By the earlier discussion on local correction, this coding scheme has the following interesting property: 
given any a £ F™, given oracle access to some r £ E™ which is Jg-close to the encoding of /, one can 
recover the value of /(a) with high probability using only g queries into r. This scheme can be used 
even for g as small as 0 ( 1 )! 

2. We now describe another local correction algorithm for multiplicity codes. This algorithm queries only 
m lines, but it only works for multiplicity codes of low rate. 
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To locally correct the value of for a € F™, given oracle access to r : F™ —>■ S, the algorithm 

works as follows. First pick a set B oim uniformly random directions from F™. With high probability, 
we will have that B will be a set of m linearly independent vectors, and if the fraction of errors do is 
sufficiently small, then all the h G B will be good. This means that we can compute R^^\h) for each 
h G B, j' < s and e with wt(e) < c. 

The following lemma implies that this data uniquely determines the polynomial Rf (X) for each j' < 
c' = c- 

Lemma 11 Let c' = c ■ . Let i?(Xi,..., he a homogeneous polynomial of degree j' < d. 

Suppose B is a set of m linearly independent vectors in F™, such that mult(i?, b) > c for each h G B. 

Then R{Xi ,..., Xm) = 0. 

Proof Without loss of generality, we may assume P = {ui,..., Um}, where G F™ is 1 in coordinate 
i and 0 in every other coordinate. The hypothesis mult(i?, u^) > c implies that for every i with wt(i) = j' 
and ii > j' — c, the coefficient of X" in i?(X) is 0. 

Finally, notice that for every i with wt(i) = j', there always exists some i G \m\ for which U > ^ > j'—c. 
Thus P(X) = 0. ■ 

Once we have computed RjifX.) for each j' < c' = c ■ ;; 7 ^, this immediately gives us If 

c' > s, then this is proper local correction algorithm, but even if c' < s this algorithm could be of 
interest. 

For completeness, we record the basic multiplicity amplification fact underlying the above decoding 
algorithm. This can also be proved using Lemma [TTJ 

Lemma 12 Let c' = c - . 

m—1 

Let a G F™. Let P{Xi ,..., X„) G F[Xi,..., Xm], and let B C F™ he a basis for F™ over Fg. For each 
hG B and each m-tuple e of nonnegative integers, define Qb,e{T) = P^®^(a + bT) G F[T]. 

Suppose Qb,e{T) = 0 for each h G B and each e with wt(e) < c. Then mult(P, a) > c'. 

4.2 Global Decoding 

We now consider decoding of multivariate multiplicity codes in the global sense. In the case of standard 
polynomial codes (the s = 1 case), the best known algorithm (due to Pellikaan-Wu [PWOlj 'l for decoding 
TO-variate codes over Fg works via a reduction to the decoding of 1-variate codes over the bigger field Fgm. 

For multiplicity codes with general s, Kopparty |Kopl2| gave a reduction from to- variate codes over Fg to 
several instances of decoding a 1-variate code over the big field Fgm. Using the algorithms for decoding 
univariate multiplicity codes discussed earlier, this gives polynomial time algorithms for unique decoding 
multivariate multiplicity codes upto half the minimum distance, and list-decoding multivariate multiplicity 
codes upto the Johnson bound. 

Below we describe a variation of the reduction of |Kopl2| . The key ingredient of that reduction is the 
construction of a certain special family of “algebraically-repelling” curves. 

Abusing notation, we call a G F^ a basis if its to coordinates form a basis for Fgm over Fg. To every basis 
a = (oi,..., Om), we associate a curve 7a(T) G Fgm [T]™, given by: 

7 „(r) = (Tr(aiT),Tr(a 2 T),...,Tr(a™r)). 
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The most interesting feature of this curve is that 70 is a bijection between F^m and F™. See |Kopl2| for 
more properties of these curves 7 a. 

A collection Oi,..., Om S F^ of bases is said to be in (s, c)-general position if there does not exist a nonzero 
polynomial i?(X) G F^m [X] of degree at most s which vanishes at each with multiplicity at least c. 

The c = 1 case of the following lemma was shown in |Kopl2| . 

Lemma 13 Suppose c < s < q. Let Oi,..., Om G F^ be bases in (s, c) general position. Let Q(X) G F^m [X] 
have degree < s ■ q. Suppose that for each i G [M] and each e with wt(e) < c, the univariate polynomial 
g^")o7a.(T) = 0 . 

Then g(X) = 0. 

The proof of this lemma is postponed to Section 14.2.21 

Explicit collections ai,..., Um G F^ in (s, c) general position with M = (f )"* can be constructed as follows. 
Take a to be a basis of F^, and bi,..., hu to be all the elements of a m-dimensional grid of side | in F™, 
and set = a + . 

Via the lemma, this gives us an explicit collection of (f )"* “algebraically-repelling” curves. We now show how 
these curves can be used for reducing multivariate decoding to univariate decoding. Again, this generalizes 
the 7 = 0, c = 1 case, which was done in |Kopl2| . 

The following lemma, relating the derivatives of a multivariate polynomial to the derivatives of its restriction 
to the curve 7 a, will motivate one of the steps of the algorithm. 

Lemma 14 Let P{Xi ,..., Xm) G Fq[Ai,..., Xm] and let Qe{T) G F^m [T] be given by QeiT) = oj^(T). 

Then for every t G F^m and every j < q: 

i:wt(i)=j ^ 

Algorithm for Reducing Multivariate Decoding to Univariate Decoding 

1. Suppose we have an algorithm A that list-decodes univariate multiplicity codes of distance S from 
ry(5)-fraction errors. 

2. Let 7 = and let c = 7 • s -f 1. 

3. Let M = (|)™. Pick bases Oi, 02 ,..., Um G F^ in (s, c)-general position. 

4. For each i G [M], for each e with wt(e) < c, define ii^e '■ IFg™ —>■ F®m'^“''^ as follows. For each j with 
0 < j < s — c -I- 1, let 

= E t 

i:wt(i)=E ^ 

5. Using algorithm A, compute the set of all Q{T) G Fgm[T] of degree at most dq'^~^ such that 
A(EnC5_c+l,c?g'^-i,l,(y^ (Q);*^ 0 - 

6 . For every {Qi{T),Q 2 iT),... ,Qm(T)) G O^i ^nd all P{Xi,... ,Xm) G F,[Ai,..., A^] with 
deg(P) < d such that for each i G [M], 

Po^,,iT) = Q,iT). 

(This is a system of linear equations over F^m with variables and (d -I- 1) • M constraints). 
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7. Output the list of all such Xm)- 

Before analyzing correctness, let us comment on the running time of this reduction. For constant m, s, we 
claim that this reduction can be implemented to run in near-linear time. The running time of this reduction 
depends the size Li, and on how quickly we can find P{Xi, ..., Xm) given Qi{T), ..., Qm(T). If we happen 
to know that the Li are all of constant size (as it happens whenever the fraction of errors is bounded below 
the Johnson radius), then the factor of |£i| is at most a constant. Thus we only need to show that the 
latter step can be implemented in near-linear time. Given Qi(T), ... ,Qm{T), we can: (1) evaluate each 
QiiT) and each of its derivatives of order < s at all points of F™, (2) via Lemma [T4l we know that this 
suffices to give us for each a G F™, (3) to interpolate P(X.) given for each a G F™. 

Thus, we get that unique decoding of multivariate multiplicity codes upto half the minimum distance can be 
done in near-linear time. Furthermore, if Nielsen’s algorithm for list-decoding univariate multiplicity codes 
upto the Johnson bound can be implemented in near-linear time, then one can also list-decode multivariate 
multiplicity codes upto (almost) the Johnson bound in near-linear time. 


4.2.1 Analysis of the decoding algorithm 

Suppose P(X) G Fq[X] is such that A(EnCs,d,m.g(-P),"c) < ^o- Let E C F™ be the set of a G F™ where 
p(<s)(a) differs from r(<'*)(a). 

We first show that Qi,e{T) := o jaiiT) G Indeed, by Lemma [T4l for every t G F^m such that 

7(1 (t) ^ E, and for every j < s — c + 1, we have: 

i:wt(i)=j ^ ^ 

i:wt(i)=i ^ '' 

i:wt(i)=j ^ ^ 

= iiAt)- 

Thus A(EnCs-c+i,d,i,qiQi,t 3 ), £i,e) < and thus Qt^e is indeed included in the list Lt. The crucial 

points here are (a) the relative distance of the univariate multiplicity code of order s — c J- 1 evaluations of 
degree d polynomials has minimum distance 1 — and (b) our choice of 7 ensures that < 77(1 — ^^)- 
Thus algorithm A is indeed capable of finding Li as required by the reduction. 


4.2.2 Algebraically repelling curves 

In this section we prove Lemma [M] and Lemma 1131 
Proof of Lemma 1141 By dehnition of derivatives, we have: 

3 

P(‘=)(7„(t) +X) = = E 

1 i ' 
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By linearity, ja{t + W) = 7 o(t) + 7a(M^)- So 


Q^{t + W) = P^^^oj^{t + W) 

= P^^Hlait)+la{W)) 


Taking this equation mod W‘^, we get the following equation; 

j<q i:wt(i)<g ^ ' 

For j < q, note that the coefficient of VF^ in the right hand side of this equation equals ( 7 „(t))a‘. 

On the other hand, the coefficient of in the left hand side of the equation equals Qe\t). We therefore 
conclude that for each j with 0 < j < q, we have 

i:wt(i)=j ^ 


Proof of Lemma 1131 We will show that for each a G F™, mult(P, a) > s. Then by Lemma |4] (recalling 
that deg(P) < sq), we can conclude that P{Xi, ..., Xm) = 0. 

Fix i € [M] and e with wt(e) < c. We have o ^aAT) = 0. By Lemma [Ml we conclude that for every 
t G Fqm and j < q: 

Y. ("(V‘-"'’(t..(()K = o. 

i:wt{i}=j 


Thus for every a G F™, every i G [M], 0 < j < s, and e with wt(e) < c: 


i: (‘’(■‘)p<-+‘'(a),; = o^ 


i:wt(i)=j 


( 8 ) 


For 0 < / < q, let Paj'(Y) G Fq[Y] be the polynomial 


Pa, 7 (Y)= ^ p(‘')(a)Y‘'. 


Then the derivatives of R^.j' are given by: 


i':wt(i')=j' 


E 

i:wt(i)=j' — wt(e) 


‘■^®)p('+®)(a)Y‘ 
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Equation ([5]) says that for each a S F™, i S [M], e with wt(e) < c, and f < q-\- wt(e), we have 

<]^K) = o. 

Thus for every j < q and a, i, e as above: 

mult(i?aj , cii) > c. 

By the general position hypothesis on a^, this implies that for each j < s, the polynomial Ra.j(Y) is itself 
identically 0. 

But the coefficients of Raj{Y) are P^')(a), for i satisfying wt(i) = j. Thus = 0 for each a and each 

i with wt(i) < s. 

Therefore mult(P, a) > s for each a G F™, which implies that P = 0, as desired. ■ 


4.3 Local List-Decoding 

The list-decoding algorithm for multivariate multiplicity codes from the Johnson radius can be used to give a 
local list-decoding algorithm for multivariate multiplicity codes upto the Johnson radius. Since the definition 
of local list-decoding is somewhat involved, we refer the reader to the appendix of |Kopl2| for the algorithm 
and its analysis. 


5 Encoding 

In this section we discuss encoding algorithms. 

Since multiplicity codes are Fg-linear subspaces of E®'® , it is natural to choose an encoding map which is 
Fq-linear. One very natural encoding map to consider is the map: 

P : F^ ^ C, 

which treats its input as a vector of coefficients of monomials for a polynomial P G¥g [X] of degree at most 
d, and outputs EnCs_d,m,ij(P)- It is well known that the task of computing E, namely evaluating a given 
polynomial and all its derivatives of order at most s at all points of F™ can be performed in near-linear time 
0((d- + g™) • ('"+*) • log(d- + q^ j). 

However, for the purposes of local decoding, it will be important to choose the encoding map P : C C 

S" a bit more carefully. The goal is to have the encoding be systematic; i.e., to have the symbols of the 
message appear as symbols (or parts of symbols) of its encoding. Once we have such an encoding map, a 
local correction algorithm immediately gives us a local decoding algorithm. 

Such a systematic encoding map can be chosen by giving an interpolating set. Concretely, for a given 
s,d,m,q, we want a set S' C F™ x {i | wt(i) < s} such that for every / : S —>■ F^, there is exactly one 
P{Xi ,..., Xm) G ]Fg[Xi,..., Xm] of degree at most d such that for each (a, i) G S, pl‘)(a) = /(a, i). 

It is easy to see that such sets S exist, and any such set S must have |S| = In order for the so 

obtained local decoding algorithm to run in sublinear time (assuming the local correction algorithm runs in 
sublinear time), it will be important that this interpolating set be explicit: given message coordinate i G [A:], 
we should be able to compute, in time poly(log(A:)), the codeword coordinate j G [n] which contains the zth 
symbol of the codeword. In |Kopl2|, an explicit such interpolating set was given. 
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Theorem 15 ( |Kopl2| ) There exist explicit interpolating sets S as above. 

Thus there exist explicit systematic encoding maps for multiplicity codes. 

The interpolating sets for multiplicity codes constructed above are in fact simple combinations of interpolat¬ 
ing sets for Reed-Muller codes. Furthermore, it is known that there exist interpolating sets for Reed-Muller 
codes from which polynomial interpolation can be performed in near-linear time. This implies, by inspecting 
the proof of Theorem ll5l that the encoding map described above can be computed in near-linear time. 


6 Discussion 

1. The improved local decoding algorithm given in Section 14.1.21 had two main ideas over the original 
local decoding algorithm of |KSY11) : getting more information from each line, and robustly combining 
this information across different lines by decoding a multiplicity code. 

The first idea is naturally motivated by an incongruity between the three papers: |KSY11) (on local 
correction of multiplicity codes), [GKS13] (on affine invariant codes, local correction of affine invariant 
codes, and their relationship to bounds on Nikodym sets), and [DKSSOQ] (giving lower bounds on the 
size of Nikodym sets via the extended method of multiplicities). 

A Nikodym set is a set N C F™ such that for every a G F™, there is some line L C F™ passing through 
a, such that L \ {a} C N (i.e., the entire line, except possibly a, is contained in N). In |GKS13] it 
was noted that lower bounds on Nikodym sets follow from the existence of algebraic error-correcting 
codes that can be locally corrected at a G F™ by querying a line through a. In |DKSS09] , the extended 
method of multiplicities (which in retrospect can be interpreted in the language of multiplicity codes) 
was used to show a lower bound of (|) on the size of Nikodym sets. On the other hand, if one tried 
to use the original local correction algorithm of [KSYII] for multiplicity codes to prove a lower bound 
on Nikodym sets (via the [GKS13] connection), we would get a significantly weaker bound than the 
bound of [DKSSOQ] . All this suggests that there should be a better algorithm for local correction of 
multiplicity codes, and (looking at the details) a way to get more information from each line. 

The second idea is motivated by a different incongruity: the local correction algorithm of [KSYll] 
combines information from different lines by decoding a Reed-Muller code, but there seems to be no 
reason for the s = 1 case of multiplicity codes (i.e., Reed-Muller codes) to receive preferential treatment 
amongst all possibilities for s. The new algorithm resolves this incongruity, and lets us use fewer lines 
for the local decoding. 

2. The decoding algorithm described in Section |4 .1. 41 based on m linearly independent lines was motivated 
by another problem in the combinatorial geometry: the joints problem [GKIOl iKSSlOj . Alex Vardy 
and Abdul Basit independently suggested to me that bounds on the joints problem could potentially be 
improved using the method of multiplicities. The m-line decoding algorithm for multiplicity codes can 
be used to give a multiplicity-enhanced proof of the [KSSIO] bound on the joints problem; unfortunately 
this variant does not improve on the bounds. 

A brief outline of the argument goes as follows. One first interpolates a low degree polynomial van¬ 
ishing with multiplicity at least a at the joints of interest (for some large a). Then one argues that 
this polynomial vanishes at each line of the collection with multiplicity at least some c. Then using 
Lemma [T^ we deduce that this polynomial actually vanishes at each of the joints with multiplicity at 
least c' ^ a. This leads to a contradiction, unless the number of joints is large. 

3. The Reed-Muller codes over small fields and in many variables have been very influential. The analogous 
multiplicity code would be based on order s evaluations of polynomials over F^ of total degree at most 
d and individual degree at most sq—1. It would be very interesting to study properties of these codes, 
and to see if they have any coding/combinatorial applications. 
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We note a curious example of how things change when the individual degrees are bounded: a polynomial 
P{Xi,.. . ,Xjn) S ^^[Xi,. .. ,Xm] of individual degree at most 1 vanishes at a point a G F™ with 
multiplicity at least s if and only if P vanishes at all points of F 2 which are at a Hamming distance at 
most s — 1 from a. 

4. There are various interesting variations/cousins of Reed-Solomon and Reed-Muller codes which are in¬ 
teresting from the coding perspective. These include algebraic-geometric codes, BCH codes, projective 
Reed-Muller codes, Grassman codes, etc. It would be interesting to investigate multiplicity-based gen¬ 
eralizations of these codes. For algebraic-geometric codes, some such investigations were made (in the 
1-dimensional case, analogous to Reed-Solomon codes) by Rosenbloom-Tsfasman |RT97j . Xing |Xin03] 
and Nielsen [NieOlj . 

7 Open Questions 

We conclude with a list of some interesting open questions. Some of these questions are open even in the 
classical s = 1 case (Reed-Solomon codes and Reed-Muller codes). 

1. What is the list-decoding radius for univariate multiplicity codes? In other words, what is the largest 
fraction ry of errors from which univariate multiplicity codes of distance 6 and block-length n can be 
list-decoded with poly(n) list-size? For general univariate multiplicity codes, this is only known to be 
true for ?7 < 1 — \/\ — 5, while for univariate multiplicity codes over prime fields with s sufficiently 
large, it is known for every rj < 5. 

This question is even open for Reed-Solomon codes. 

Here are some related questions. Does the answer depend on the field? Does the answer depend on 
the set of evaluation points? What happens for multivariate multiplicity codes (again, this is open for 
multivariate Reed-Muller codes too)? 

2. It is an extremely interesting question whether the list-size for list-decoding univariate multiplicity 
codes over prime fields (as in [GWIIl[Kopl2| ) needs to be poly((y), or if it can be reduced to a constant 
independent of q. 

It is also extremely interesting to know whether the primality of q is essential for the improved list¬ 
decoding of multiplicity codes in [GWIIl |KopI2| . 

3. Gan Nielsen’s algorithm for list-decoding univariate multiplicity codes upto the Johnson bound be 
implemented to run in near-linear time. It would also immediately imply a near-linear time global 
algorithm, and a faster local algorithm, for list-decoding multivariate multiplicity codes upto the John¬ 
son radius. This seems to require some nontrivial adaptation of the ideas of Alekhnovich [AleOb] . who 
showed how to list-decode Reed-Solomon codes in near-linear time. 

4. Are multiplicity codes locally testable? 

5. Are there any applications of multiplicity codes to computational complexity theory? Reed-Solomon 
codes and Reed-Muller codes have found many celebrated applications, and it would be interesting to 
see if multiplicity codes can improve on any of them. 

6. Are there any practical applications of multiplicity codes? By combining high rate with sublinear- 
time decoding, and also supporting various other efficent operations, multiplicity codes seem to be 
theoretically practical. Perhaps they really are practical? 
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